# Cyber Essentials scope Which devices, cloud services, home routers and personal phones count under version 3.3, and when a separated sub-set is an acceptable boundary. Source: https://sted.digital/docs/standards/cyber-essentials/scope · Last reviewed 17 October 2026 · Strand Standards and regulations Cyber Essentials scope is the boundary your certificate covers: the whole organisation, or a separately managed sub-set cut off from the rest by a firewall or VLAN. Under version 3.3 of the NCSC requirements, end-user devices must always be inside it, cloud services holding your data can never be left out, and personal devices that reach work data count too. ## The requirement in plain English Scope comes before the five controls because every control applies to everything inside it. You define the boundary by the business unit that manages it, its network boundary and its location, and you agree it with your certification body before the assessment starts. **Whole organisation or sub-set.** The default is all the IT you use to run the business. A sub-set is allowed when part of the organisation is separated from the rest by a firewall or VLAN, and you justify the exclusion to the assessor. A scope with no end-user devices is never acceptable. **What counts.** Any device or software that can accept connections from the internet, make connections out to it, or control traffic between the two is in scope. That covers servers, desktops, laptops, tablets, phones, routers, firewalls and virtual machines. **Cloud services.** If a cloud service holds or processes your organisation's data, it is in scope and cannot be excluded. The provider may run some controls (a software-as-a-service provider handles its own servers' updates), but you remain answerable for all five, and the provider's commitment must sit in your contract or the documents it references. **Personal and remote devices.** Staff-owned devices that reach organisational data or services are in scope; ones used only for native calls, texts or an authenticator app are not. Home and remote devices are in scope. A router you supply to a home worker is in scope; one they own is not, which is why their device needs its own software firewall under Cyber Essentials, firewalls. **Third parties.** Every account your organisation owns is in scope, including those a managed service provider or contractor uses to run your systems (Cyber Essentials, user access control). Devices you lend to others are in scope; devices contractors and customers own are not. **Software you build.** Commercial web applications are in scope by default; your own bespoke code is not, though the NCSC points developers to the Software Security Code of Practice. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 30-person engineering consultancy with an office, most staff working from home two days a week, Microsoft 365, a cloud hosting account and two contractors. - **One-page scope statement.** "Whole organisation", the office network, every company laptop and phone, staff phones that read work email, and each cloud service named, with the date the certification body agreed it. - **Live asset list.** Every device with its owner and operating system, fed by the device-management tool rather than typed up the week before the assessment. The NCSC calls asset management a core function even though it is not one of the five controls. - **Cloud service register.** Each service, what data it holds, who administers it, whether multi-factor authentication is on, and where the provider's security commitments are written down. - **Approved technology list.** The software and personal-device types staff may use, approved by the operations director, so a new tool joins the scope deliberately rather than by surprise. - **Third-party access.** The contractors' accounts are listed, use multi-factor authentication, and are reviewed at each renewal. Whole-organisation scope also keeps the IASME-arranged cyber insurance on the table, because it is only offered to organisations under £20 million turnover that certify the whole organisation. ## Evidence an auditor expects - **Scope description in the self-assessment**: required. The assessor checks it names the boundary, the business unit and the location, and that end-user devices and cloud services are inside it. - **Justification for any sub-set**: required when the scope is partial. The assessor checks the reason and how the sub-set is separated. - **Segregation proof**: tested at Plus. The assessor confirms by technical means that excluded parts really are cut off and that the Plus scope matches the self-assessment certificate. - **Device and cloud service inventory**: usual, not required. It is how you answer the device and software questions accurately, and it is the first thing a Plus assessor samples from. - **Contracts or trust-centre statements** for cloud services: required where a provider runs a control on your behalf. - **Third-party account list**: usual. Shows every supplier-used account is known and protected. ## Common mistakes ### Forgetting the second-tier cloud Teams list the email suite and the hosting account, then miss the design tool, the survey platform or the payroll portal a manager signed up for. Under version 3.3 each one holding your data is in scope, and each needs multi-factor authentication. Pull the list from your finance system's subscriptions as well as from IT. ### A sub-set that is only a sub-set on paper "Head office only" fails if the same laptops roam between head office and everything else. A sub-set needs a real network separation, and at Plus the assessor verifies it technically before testing starts. If you cannot draw the firewall line, choose whole organisation. ### Personal phones reading work email The phone that only gets mail is the device most often left off the list. If it reaches organisational data, it is in scope and needs a supported operating system, updates within 14 days, a screen lock and approved apps. Either bring personal phones under those rules or move work email to managed devices. ### The managed service provider's admin account Accounts your organisation owns stay in scope when a supplier uses them, and you must be able to show the supplier meets the controls. An admin account shared by the provider's whole support desk fails user access control twice: no unique credentials and no separate administration. ### Agreeing scope after answering The scope is agreed with the certification body before the assessment, not adjusted afterwards to fit the answers. A buyer reads the scope line on your certificate, and a partial scope that excludes the service they use may not satisfy them. ## How Sted helps Sted's Asset Management Policy (POL-ASM) covers your asset register, asset owners, disposal, return of assets by leavers and personally owned devices, and the knowledge base tags it to Cyber Essentials. The Approved End-User Technology Record (REC-AET), under the Acceptable Use Policy (POL-AUP), records each device, program or app you approve for work: who approved it and when, what it may and may not be used for, and the security conditions attached. Records are part of the Full Management System plan. Sted does not connect to your cloud, code or HR systems to collect evidence automatically; you record it. Sted does not discover your devices or cloud services and does not decide your scope. You record the boundary, and your certification body agrees it. ## Related guides and terms - [Cyber Essentials](/docs/standards/cyber-essentials): the scheme, its current edition and how certification works. - [The five Cyber Essentials technical controls](/docs/standards/cyber-essentials/five-technical-controls): what applies to everything inside the boundary. - [Cyber Essentials self-assessment and Cyber Essentials Plus](/docs/standards/cyber-essentials/self-assessment-vs-plus): how the scope is checked at marking and at the Plus audit. - [Certification body](/docs/glossary/certification-body): who agrees your scope and marks your answers. - [Evidence](/docs/glossary/evidence): what counts when a buyer or assessor asks you to show it. ## Frequently asked questions Q: Are staff personal phones in scope for Cyber Essentials? A: Yes, if they reach organisational data or services, such as work email, chat or file storage. A personal phone used only for ordinary calls, ordinary texts or an authenticator app is out of scope. Students' own devices are out of scope in education settings, while employees', volunteers' and trustees' are in. Q: Can I leave a cloud service out of my Cyber Essentials scope? A: No. Since version 3.3 any cloud service that holds or processes your organisation's data must be in scope, however little you use it. The provider may run some controls for you, but you answer for all of them and need its commitment in the contract or documents the contract refers to. Q: Do home workers' routers have to meet Cyber Essentials? A: Only if you supplied the router. Routers people own themselves are out of scope, so each home worker's device needs its own software firewall switched on instead. A worker who connects through your corporate VPN sits behind your company firewall.